Slack error bad_client_secret: client_secret is invalid
Last verified against Slack API reference - chat.postMessage errors
Value passed for client_secret was invalid.What error bad_client_secret means
Slack did not accept the client_secret you sent to oauth.v2.access. The description is "Value passed for client_secret was invalid." Its partner, invalid_client_id, covers a bad client_id. Either way, no token is issued and the install fails.
The secret is found under your app's Basic Information page and is paired with one specific app. The common mistakes are mixing apps (the staging app's secret with the production app's client ID), confusing it with the signing secret or verification token on the same page, using a secret that was regenerated, or picking up whitespace and quotes from an environment file.
The method's notes recommend sending the client ID and secret using HTTP Basic authentication rather than as body parameters. If you use Basic auth, also check the encoding: base64 of client_id:client_secret.
What it looks like
POST /api/oauth.v2.access
Authorization: Basic <base64(client_id:client_secret)>
code=...
{"ok": false, "error": "bad_client_secret"}Why it happens
- The secret belongs to a different Slack app than the client_id.
- The signing secret or verification token was used instead of the client secret.
- The client secret was regenerated and the deployed config was not updated.
- The value has stray whitespace or quotes from an env file, or the Basic auth header is malformed.
How to fix Slack error bad_client_secret
- 1Copy the Client Secret from the same app's Basic Information page as the Client ID.
- 2Check that the deployed config matches, and strip whitespace and quotes.
- 3If using Basic auth, base64-encode client_id:client_secret exactly.
- 4If the secret may have leaked, regenerate it and redeploy every environment that uses it.
How to stop it recurring
Store Slack credentials as a labeled set per app (client ID, client secret, signing secret) in a secrets manager, and validate at startup that the client ID matches the expected app. Keep secrets out of client-side code and logs. Rotate secrets through the same pipeline for every environment.
Official reference: Slack API reference - chat.postMessage errors. See all Slack error codes or the Slack limits and quotas.
Related codes
- invalid_code: OAuth authorization code is invalidValue passed for code was invalid.
- bad_redirect_uri: redirect_uri does not match the original requestValue passed for redirect_uri did not match the redirect_uri in the original…
- invalid_auth: Authentication cannot be validatedSome aspect of authentication cannot be validated. Either the provided token…
- invalid_refresh_token: Refresh token is invalidThe given refresh token is invalid.
Error bad_client_secret - quick answers
What does Slack error bad_client_secret mean?
Slack did not accept the client_secret you sent to oauth.v2.access . The description is "Value passed for client_secret was invalid." Its partner, invalid_client_id , covers a bad client_id . Either way, no token is issued and the install fails. The secret is found under your app's Basic Information page and is paired with one specific app.
How do I fix Slack error bad_client_secret?
1. Copy the Client Secret from the same app's Basic Information page as the Client ID. 2. Check that the deployed config matches, and strip whitespace and quotes. 3. If using Basic auth, base64-encode client_id:client_secret exactly. 4. If the secret may have leaked, regenerate it and redeploy every environment that uses it.
Stop debugging Slack by hand
Connect the channel through Conferbot: tokens, webhooks and retries are handled, failures show as readable status.